Cookbook / Production

HTTPS and HTTP/2

Serve TLS directly with rustls and get HTTP/2 negotiated automatically.

One call enables HTTPS. Clients that support HTTP/2 negotiate it over ALPN; everyone else gets HTTP/1.1 on the same port.

src/main.rs

use axeon::Server;

fn main() {
    let mut app = Server::new();
    app.with_tls("cert.pem", "key.pem");
    app.get("/", |_req| async { "secure hello" });
    app.listen("127.0.0.1:8443").expect("server failed to start");
}

Terminal

# a self-signed certificate for local development
openssl req -x509 -newkey rsa:2048 -nodes -days 30 \
  -keyout key.pem -out cert.pem -subj '/CN=localhost' \
  -addext 'subjectAltName=DNS:localhost'

curl --cacert cert.pem --http2 -i https://localhost:8443/

Notes#

The TLS handshake counts against request_timeout, so slow or stalled handshakes cannot tie up connections.
Most deployments terminate TLS at a load balancer or reverse proxy and run Axeon on plain HTTP. Do that if you already have one.
Add SecurityHeaders for HSTS once the site is HTTPS-only. See Hardening an API.
The tls feature is on by default. Disable default features to leave it out.